Legal
What we store, why we store it, who else sees it, and how to get it back.
In short
Your account. Email address, a password hash (never the password), a display name, optionally a country, and the times you created the account and last signed in.
Your Lichess link. Your Lichess user id and username, any title, your ratings for bullet, blitz, rapid and classical, whether each is provisional, your number of rated games, the date your Lichess account was created, and the two standing facts Lichess publishes: whether the account carries a terms-of-service mark and whether it is closed. All of this is read from Lichess, never typed by you.
Your entries. Which tournaments you registered for, when, what you paid, the eligibility decision and its reasons, and your results and any prize.
Payments. Stripe’s identifiers for the session and the charge, the amount, the currency and the status. Not your card number, not your name on the card, not your billing address. Payment happens on a page hosted by Stripe; those details never reach our servers.
Fair-play checks. Every automatic account check, what it found, and the account facts it was decided on. See the fair-play policy.
Sessions and security records. Session tokens, rate-limit counters, and an audit log of actions that move money, access or roles — which may include the IP address the action came from.
Connecting Lichess uses OAuth. We ask for no permissions at all — zero scopes. The authorisation proves you control the account and lets us read your public profile once.
As soon as we have read your identity, the access token is revoked at Lichess and discarded. For the overwhelming majority of players, Chess4prize therefore holds no Lichess credential whatsoever: we cannot play as you, message as you, or see anything about your account that is not already public.
An administrator creating tournaments may grant scopes, because creating an arena requires them. Where a token is kept, it is encrypted at rest with AES-256-GCM, and it is deleted when the account is unlinked.
Afterwards we keep your ratings current by reading your public Lichess profile — the same page anybody on the internet can see.
We do not sell your data, we do not share it for advertising, and we run no advertising or analytics trackers on this site.
These parties are necessarily involved:
Publicly visible: your Lichess username appears in tournament standings, on the leaderboard, and beside any prize you win. Your email address is never shown publicly.
Write to info@chess4prize.com from the address on your account and ask for:
You can unlink your Lichess account yourself at any time, from your account settings. Unlinking deletes the stored Lichess data and revokes any token we hold.
What deletion cannot remove: records of money taken and prizes paid have to be kept for accounting, and a result that has already been published in standings is part of a tournament that other people played in. In those cases we remove what identifies you personally and keep what the record requires.
If you are in the EU or UK you have these rights by law and can complain to your national data protection authority. The supervisory authority for Chess4prize depends on where the operating entity is established, which is an open item below.
Sessions, one-time email tokens, password-reset tokens and rate-limit counters expire on their own and are deleted automatically by a background process.
Account data is kept while your account exists. Records of payments, entries and prizes are kept beyond account deletion for as long as accounting rules require.
A specific retention period for fair-play checks and audit records after an account is closed has not been fixed yet. We would rather leave that blank than write a number nobody has agreed to keep to — see the open items.
Passwords are hashed, never stored or recoverable. Any Lichess token we keep is encrypted at rest. All traffic is over HTTPS. Payment card details never touch our servers.
Sign-in and password-reset attempts are rate-limited, and actions that move money, access or roles are written to an append-only audit log.
No system is perfectly secure. If you find a vulnerability, please write to info@chess4prize.com before disclosing it publicly.
Chess4prize takes entry fees and pays prize money, so it is not for children. A minimum age is stated in the terms.
These are facts about the operating business rather than about how the platform works, and inventing them would be worse than leaving them out. They are required before Chess4prize charges a live entry fee.
This document is written by the people who built and operate Chess4prize. It has not been reviewed by a lawyer, and it is not legal advice. It describes how the platform actually behaves; where something is undecided it says so rather than guessing.
